CVE-2024-55549: Libxslt Use-After-Free Vulnerability

CVE-2024-55549 Overview

CVE-2024-55549 is a use-after-free vulnerability [CWE-416] in libxslt versions prior to 1.1.43. The flaw resides in the xsltGetInheritedNsList function and is triggered through improper handling of excluded result prefixes during XSLT stylesheet processing. libxslt is the GNOME project's XSLT C library, widely embedded in browsers, scripting language bindings, and enterprise applications that transform XML content. Attackers with local access and low privileges can exploit this issue to achieve memory corruption, potentially leading to code execution or process compromise. The vulnerability was published to the National Vulnerability Database on March 14, 2025.

Critical Impact
Local attackers can trigger memory corruption in applications parsing untrusted XSLT stylesheets, resulting in confidentiality, integrity, and availability loss.

Affected Products

xmlsoft libxslt versions before 1.1.43
Downstream Linux distributions bundling vulnerable libxslt builds (Debian LTS advisory issued)
Applications and language bindings that link against the affected libxslt library

Discovery Timeline

2025-03-14 - CVE-2024-55549 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-55549

Vulnerability Analysis

The defect exists in xsltGetInheritedNsList, a helper responsible for collecting inherited XML namespace declarations while processing XSLT transformations. When a stylesheet uses the exclude-result-prefixes attribute, the function manipulates namespace pointers that may reference already-freed memory. Subsequent access to these dangling pointers produces classic use-after-free behavior [CWE-416]. Exploitation requires an attacker to supply a crafted XSLT stylesheet or XML document processed by an application linked against a vulnerable libxslt build. Because libxslt is embedded in browsers, PHP, Python lxml, and various server-side tooling, the attack surface extends across desktop, server, and container workloads.

Root Cause

The root cause is incorrect lifetime management of namespace list entries during exclusion of result prefixes. The function retains a reference to a namespace node after it has been released, then dereferences that pointer when building the inherited list. Freed memory can be reallocated with attacker-influenced content, enabling controlled memory corruption.

Attack Vector

Exploitation is local and requires low privileges with no user interaction. An attacker supplies a malicious stylesheet to any process performing XSLT transformations. Successful exploitation can corrupt heap metadata, achieve arbitrary read or write primitives, and escalate to code execution within the victim process context.

No public proof-of-concept code is available. Technical details are tracked in the GNOME libxslt Issue Report.

Detection Methods for CVE-2024-55549

Indicators of Compromise

Unexpected crashes or segmentation faults in processes that call libxslt routines, particularly xsltGetInheritedNsList.
Heap corruption signatures reported by AddressSanitizer or glibc malloc diagnostics during XSLT parsing.
Presence of untrusted XSLT stylesheets containing unusual exclude-result-prefixes constructs in temporary directories or web upload paths.

Detection Strategies

Inventory installed libxslt package versions across Linux, macOS, and Windows hosts and flag any release below 1.1.43.
Monitor application logs from browsers, PHP, and Python runtimes for XSLT parser errors or abnormal terminations.
Deploy runtime memory safety tooling such as AddressSanitizer in test environments to surface the use-after-free during regression testing.

Monitoring Recommendations

Alert on child process crashes for services that expose XSLT transformation endpoints to user-supplied data.
Correlate XML or XSLT upload activity with subsequent process instability on the same host.
Track downstream vendor advisories, including the Debian LTS Announcement, for backported fixes.

How to Mitigate CVE-2024-55549

Immediate Actions Required

Upgrade libxslt to version 1.1.43 or later on every affected host and rebuild statically linked applications.
Apply distribution-provided patches, including the Debian LTS package update referenced in the advisory list.
Restrict which local users and services are allowed to submit arbitrary XSLT stylesheets to reduce exposure.

Patch Information

The upstream fix is tracked in the GNOME libxslt Issue Report and is included in libxslt1.1.43. Linux distributions have issued backports; consult the Debian LTS Announcement for package-specific versions. Rebuild any application that statically links libxslt after updating the library.

Workarounds

Disable XSLT processing in applications that do not require it, particularly server-side XML pipelines.
Reject or sanitize stylesheets containing exclude-result-prefixes from untrusted sources until patches are applied.
Run XSLT parsing services under sandbox or seccomp confinement to limit the impact of memory corruption.

bash

# Verify installed libxslt version on Debian/Ubuntu systems
dpkg -l | grep libxslt
apt-get update && apt-get install --only-upgrade libxslt1.1

# Verify installed libxslt version on RHEL/Fedora systems
rpm -q libxslt
dnf update libxslt